Technologies for supporting multiple digital rights management protocols on a client device

ABSTRACT

Technologies for supporting and implementing multiple digital rights management protocols on a client device are described. In some embodiments, the technologies include a client device having an architectural enclave which may function to identify one of a plurality of digital rights management protocols for protecting digital information to be received from a content provider or a sensor. The architectural enclave select a preexisting secure information processing environment (SIPE) to process said digital information, if a preexisting SIPE supporting the DRM protocol is present on the client. If a preexisting SIPE supporting the DRM protocol is not present on the client, the architectural enclave may general a new SIPE that supports the DRM protocol on the client. Transmission of the digital information may then be directed to the selected preexisting SIPE or the new SIPE, as appropriate.

TECHNICAL FIELD

The present disclosure generally relates to technologies for supportingmultiple digital rights management protocols on a client device. Moreparticularly, the present disclosure relates to technologies forsupporting multiple digital rights management protocols with a singleclient device using one or more secure processing environments.

BACKGROUND

Consumers and content developers are becoming increasingly interested inproducing and receiving content (e.g., audio, video, software, etc.) indigital form. Technologies for producing and distributing digitalinformation in large quantities and across long distances have thereforebeen developed. Such technologies have enabled content providers toreach unprecedented numbers of consumers in a cost effective manner and,in turn, have provided consumers with unprecedented access to largeamounts of digital information.

Because digital information may be easily copied and distributed,digital rights management (DRM) protocols have been developed to protectdigital information as it is transmitted to, stored on, and consumed byan electronic device. In many instances a DRM protocol may protectdigital information by encrypting it with an encryption key prior totransmission to an electronic device. Consumers wishing to access thedigital information may only conveniently do so if their devicepossesses an appropriate decryption key. Although such DRM protocols canbe effective, many consumer devices maintain DRM decryption keys inunsecured memory. This may allow a hacker or other entity to easilyobtain the decryption key(s), bypass the DRM protocol, and gainunauthorized access to the digital information.

To further harden the security of digital information, some contentproviders employ hardware (HW) DRM protocols to protect their digitalinformation. A HW DRM protocol may require devices that are to consumedigital information produced by a content provider to include a hardwareDRM module. The content provider may require the hardware DRM module tobe specifically configured to include hardware and/or software resourcesthat support a defined set of DRM protocols, which may also be specifiedthe content provider. Although effective, the usefulness of a hardwareDRM protocol is limited by the fact that a hardware DRM module haslimited resources which are specifically designed to support specificDRM protocols.

Indeed because of its design and/or limited resources, it may bedifficult or impossible for a hardware DRM module to execute DRMprotocols other than those it was specifically designed to support. Thispresents a usability issue, particularly when DRM protocols changeand/or multiple content providers wish to use different DRM protocols toprotect their content. This can also present a usability issue withrespect to the protection of content that may be created by a clientdevice, where different DRM protocols may be preferred by differentusers and/or required to protect content produced from differentsources.

BRIEF DESCRIPTION OF THE DRAWINGS

Features and advantages of embodiments of the claimed subject matterwill become apparent as the following Detailed Description proceeds, andupon reference to the Drawings, wherein like numerals depict like parts,and in which:

FIG. 1 illustrates an exemplary system for supporting multiple digitalrights management protocols including a client device consistent withthe present disclosure;

FIG. 2 is a flowchart of exemplary operations consistent with an examplemethod of supporting multiple digital rights management protocolsconsistent with the present disclosure, in a use case in which a clientdevice receives digital information from a content provider.

FIG. 3 depicts another exemplary system for supporting multiple digitalrights management protocols, including another example of a clientdevice consistent with the present disclosure;

FIG. 4 is a flowchart of exemplary operations consistent an examplemethod of supporting multiple digital rights management protocolsconsistent with the present disclosure, in a content creation use case.

DETAILED DESCRIPTION

While the present disclosure is described herein with reference toillustrative embodiments for particular applications, it should beunderstood that such embodiments are exemplary only and that theinvention as defined by the appended claims is not limited thereto.Indeed for the sake of illustration the technologies described hereinmay be discussed in the context of one or more use models in whichspecific digital rights management (DRM) protocols are employed toprotect digital information. Such discussions are exemplary only, and itshould be understood that all or a portion of the technologies describedherein may be used in other contexts and with other DRM protocols. Thoseskilled in the relevant art(s) with access to the teachings providedherein will recognize additional modifications, applications, andembodiments within the scope of this disclosure, and additional fieldsin which embodiments of the present disclosure would be of utility.

The terms “client” and “client device” are interchangeably used hereinto refer individually or collectively to any of the large number ofelectronic devices that may be used to support multiple DRM protocolswith one or more secure processing environments. In this regard, anykind of mobile or stationary device may be used as a client device,provided it is capable of hosting one or more secure processingenvironments and resources that may be needed to support a plurality ofDRM protocols, as will be discussed in detail below.

Non-limiting examples of suitable client devices include cameras, cellphones, computer terminals, desktop computers, electronic readers,facsimile machines, kiosks, netbook computers, notebook computers,internet devices, payment terminals, personal digital assistants, mediaplayers and/or recorders, servers, set-top boxes, smart phones, tabletpersonal computers, televisions, ultra-mobile personal computers, wiredtelephones, combinations thereof, and the like. Such devices may beportable or stationary. Without limitation, the client's describedherein are preferably in the form of a cellular phone, desktop computer,electronic reader, laptop computer, set-top box, smart phone, tabletpersonal computer, television, or ultra-mobile personal computer.

The term “digital information” is used herein to refer to content suchas audio, video, imagery, text, markup, pictures, metadata, hyperlinks,source code, digital rights management (DRM) software, other software,licenses, encryption and/or decryption keys, authentication credentials,digital signature keys, access policies, other data (e.g. sensor data),combinations thereof, and the like, which may be stored in digital formin a computer readable medium.

The term “content provider” is used herein to refer to a device or otherentity that produces and/or transfers digital information to a client.In some embodiments, a content provider may be in the form of anelectronic device or storage medium that transfers digital informationto a client. For example, a content provider may be a third partydevice, a storage medium such as a magnetic recording medium, a flash(e.g., NAND or NOR) memory device, a thumb drive, an optical disc, etc.,combinations thereof, and the like. Alternatively or additionally, acontent provider may be in the form of one or more servers, which maytransmit or otherwise provide digital information protected by one ormore DRM protocols to a client in any suitable manner, such as via wiredor wireless transmission. Similarly, a content provider may be one ormore sensors coupled to or otherwise in communication with a clientdevice.

For the sake of clarity and ease of understanding, many of the FIGSillustrate systems in which a single content provider provides digitalinformation to a client. Such illustrations are exemplary and any numberof content providers may be used. Indeed, the technologies describedherein may be implemented with a plurality (e.g., 2, 5, 10, 20, 50, 100or more) content providers, any or all of which may employ different DRMprotocols to protect its respective digital information. Thus, while thepresent disclosure may refer to a content provider in the singular, suchexpressions should be interpreted as also encompassing the plural form.

As used in any embodiment herein, the term “module” may refer tosoftware, firmware and/or circuitry that are configured to perform oneor more operations consistent with the present disclosure. Software maybe embodied as a software package, code, instructions, instruction setsand/or data recorded on non-transitory computer readable storagemediums. Firmware may be embodied as code, instructions or instructionsets and/or data that are hard-coded (e.g., nonvolatile) in memorydevices. “Circuitry”, as used in any embodiment herein, may comprise,for example, singly or in any combination, hardwired circuitry,programmable circuitry such as computer processors comprising one ormore individual instruction processing cores, state machine circuitry,software and/or firmware that stores instructions executed byprogrammable circuitry. The modules may, collectively or individually,be embodied as circuitry that forms a part of one or more clientdevices.

As briefly described in the background, content providers often protecttheir digital information with one or more digital rights management(DRM) protocols. As the suite of available DRM protocols increases andsuch protocols are updated over time, it is becoming increasinglydifficult to support those protocols with hardware DRM models thatemploy one or more hardware DRM modules. Indeed because hardware DRMmodules generally have fixed resources, their host clients often cannotbe adapted to implement new/updated DRM protocols without making achange to the hardware DRM module itself.

Some content providers may choose to protect their digital informationwith a DRM protocol that does not employ a hardware DRM module. Althoughsuch DRM protocols may not suffer from the drawbacks associated with theuse of a hardware DRM module such as those noted above, they may haveother disadvantages. For example, such DRM protocols may rely on theprovisioning of secrets (e.g., decryption keys, licenses, accesspolicies, etc. to a client device, which the client may store inunprotected memory. As a result, it may be relatively easy for a hackeror other entity to attack the client and gain access to the secretsstored thereon. The hacker/entity may then use those secrets to accessthe digital information, effectively bypassing the DRM protocol that wasused to protect that information.

With the foregoing in mind, the present disclosure generally relates totechnologies (e.g., devices, systems, methods, computer readable media,etc.) for supporting and/or implementing multiple different DRMprotocols on a client device. As will be described in detail later, thetechnologies of the present disclosure generally utilize client devicesthat include one or more secure processing environments. Theseenvironments may function in part to harden the security of digitalinformation on a client device, e.g., by protecting the plaintext of thedigital information as well as assets that may be utilized in a DRMprotocol to be implemented in the secure processing environment. Andbecause such environments may be flexibly configured (e.g., withpartitioned assets of their host client device or even a third partydevice), they may be used to support a wide variety of DRM protocols,even without a hardware update to the client device.

More particularly, the secure processing environments may provide asecure location for the storage and/or execution of assets that may beused in the implementation of one or more DRM protocols. For example,such environment(s) may provide a secure location for the storage,execution, and use of the plaintext of digital information, theplaintext of information encryption keys used to encrypt digitalinformation, authentication credentials, policies governing access todigital information, various modules for digital rights management andpolicy enforcement, combinations thereof, and the like. Due to thenature of the environments, the assets maintained therein may beprotected from unauthorized access by third parties.

Memory enclaves are one example of a secure processing environment thatmay be used in the client devices of the present disclosure. A memoryenclave is made up of at least one memory page that has a differentaccess policy than the access policy imposed by traditional ringboundaries of a computing device. The memory page(s) within a memoryenclave may have associated read/write controls which may be configuredsuch that the read/write controls have exclusivity over certainoperating modes or privilege “rings”, system management mode or virtualmachine monitors of an associated processor. A memory enclave maytherefore be designed to provide a sheltered place to host and executetrusted code, data, and the like such that it may be protected fromother software on a client, including application software andprivileged software such as an operating system, a virtual machinemonitor, combinations thereof, and the like. It should be understoodthat the terms “memory enclave” and “secure enclave” are usedinterchangeably in the context of the present disclosure. Withoutlimitation, suitable memory enclaves include those provided using INTEL™secure enclave technology, which may be implemented using Intel secureguard instructions (SgX) or in another manner. Of course, other suitablememory enclave technologies may be used.

Reference is now made to FIG. 1, which depicts one example of a systemfor supporting multiple digital rights management protocols with aclient device consistent with the present disclosure. As shown, system100 includes client device 101 (client 101), content provider 102 andoptional network 103. FIG. 1 may therefore be understood to depict a usecase in which a content provider (e.g., a third party) is to providedigital information to a client device for consumption. Accordingly inFIG. 1, a user may wish to consume digital information received fromcontent provider 102 on client 101. Client 101 and content provider 102may therefore be in wired or wireless communication, such that contentprovider 102 may transmit digital information to client 101 using one ormore predetermined wired or wireless communication protocols.

This concept is shown in FIG. 1, which depicts content provider 102transmitting digital information 114 (DI 114) to client 101 directly,e.g., via a close range communication technique such as near fieldcommunication, a BLUETOOTH® connection, a ZigBee network, combinationsthereof, and the like. Of course, communication of DI 114 to client 101need not occur via a close range communication technique. Indeed, thepresent disclosure envisions systems wherein content provider 102transmits DI 114 to client 101 via a relatively long range communicationtechnique, such as via network 103. In this regard, network 103 may beunderstood as correlating to one or more of a wide area network (e.g.,the internet), an enterprise network, a wireless communications network(e.g., a WiFi network, a cellular network, etc.), combinations thereof,and the like. Content provider 102 may be prompted to transmit DI 114 toclient 101, e.g., in response to a content request message received fromclient 101. Transmission of the content request message may beinstigated by a user (e.g., via a user interface) and/or an applicationexecuted on client 101.

Client 101 includes device platform 104, which may be any suitabledevice platform. Without limitation, it is preferred that deviceplatform 104 correlate to the type of device used as client 101. Thusfor example, where client 101 is a cellular phone, smart phone, desktopcomputer, laptop computer, etc., device platform 104 is preferably acellular phone platform, smart phone platform, desktop computerplatform, laptop computer platform, etc. respectively.

Regardless of its nature, device platform 104 may include processor 105,memory 106, and input/output resources 107 (I/O 107). Processor 105 maybe any suitable general purpose processor or application specificintegrated circuit, and may be capable of executing one or multiplethreads on one or multiple processor cores. Without limitation,processor 105 is preferably a general purpose processor, such as but notlimited to the general purpose processors commercially available fromINTEL® Corp., ADVANCED MICRO DEVICES®, ARM®, NVIDIA®, APPLE®, andSAMSUNG®. While FIG. 1 illustrates client 101 as including a singleprocessor, multiple processors may be used. Without limitation,processor 105 is preferably a past, present or future produced single ormulticore INTEL® processor.

Memory 106 may be any suitable type of computer readable memory.Exemplary memory types that may be used as memory 106 include but arenot limited to: semiconductor firmware memory, programmable memory,non-volatile memory, read only memory, electrically programmable memory,random access memory, flash memory (which may include, for example NANDor NOR type memory structures), magnetic disk memory, optical diskmemory, combinations thereof, and the like. Additionally oralternatively, memory 106 may include other and/or later-developed typesof computer-readable memory.

I/O 107 may include hardware (i.e., circuitry), software, or acombination of hardware and software that is configured to allow client101 to transmit and receive communications to and from content provider102. Communication between I/O 107 and content provider 102 may occurover a wired or wireless connection using a close and/or long rangecommunications network as described generally above. I/O 107 maytherefore include hardware to support such communication, e.g., one ormore transponders, antennas, BLUETOOTH™ chips, personal area networkchips, near field communication chips, network interface cards,combinations thereof, and the like.

As noted above, content providers such as content provider 102 may be inthe form of one or more data storage mediums. In such instances I/O 107may be configured to receive information (e.g., digital information,license policies, keys, resource requirements, etc.) from a data storagemedium such as a magnetic recording medium, optical recording medium,magneto-optical recording medium, a solid state (FLASH) recordingmedium, combinations thereof, and the like. I/O 107 may of course beconfigured to receive digital information from diverse content sources,including a combination of recording media and a computing system suchas a server, which may be local to or remote from client 101.

The client devices described herein may also include a plurality ofsecure processing environments, such as one or more DRM architecturalenclaves and secure information processing environments (SIPEs). For thesake of brevity, DRM architectural enclaves are often referred to inthis disclosure simply as an “architectural enclave” or “AE”. Thisconcept is illustrated in FIG. 1, which depicts client 101 as includingDRM architectural enclave (AE) 108 and secure information processingenvironments (SIPEs) 111 ₁ and 111 _(n). It is noted that SIPEs 111 ₁and 111 _(n) are illustrated with hashing to emphasize that they may ormay not be pre-provisioned on client 101, e.g., at the time a contenttransmission request (e.g., CTR 113) is received from content provider102, or some other source of digital information. For clarity, SIPEsthat are present on client 101 prior to the receipt of a CTR arereferred to herein as a “preexisting SIPE.” In contrast, an SIPE that isgenerated or “spawned” by architectural enclave 108 e.g., in response toreceipt of a CTR are referred to herein as a “new SIPE.”

In general architectural enclave (AE) 108 is a secure processingenvironment (such as a memory enclave) which may include policyenforcement module 109 (PEM 109). PEM 109 may be executed withinarchitectural enclave 108 (e.g., with processing resources allocatedthereto), and may function in part to determine which of a plurality ofDRM protocols is to be implemented with respect to a particular piece ofdigital information, such as DI 114. PEM 109 may make this determinationby leveraging information contained in one or more policies 110 storedin architectural enclave 108. Policies 110 may include, among otherthings, a DRM selection policy (not separately illustrated).

In general, a DRM selection policy may be a database or other datastructure which associates one or a combination of DRM selection factorswith one or more DRM protocols. Non-limiting examples of DRM selectionfactors that may be used include categorical factors such as thedepartment with which a user of the client device is associated, such ashuman resources, executive office, etc., the type of device/sensor thatproduced the digital information, etc. as well as an assignedcompartmentalization of the digital information in question. Forexample, where digital information may correspond to global positioninginformation, a categorization assigned to that information may be ageographic region, such as “North America.”

Other examples of DRM factors include the type of digital information inquestion such as audio, video, code, etc., level factors such as thesecurity level of the digital information in question, user securitylevel, client device security level, security level of the environmentin which a sensor that generated the digital information is located,etc., contextual factors such as the identity of the content provider,time of day, type and/or identity of the network/sensor from which thedigital information will be received, client device location, userpresence, user identity, combinations thereof, and the like. Furtherexamples of DRM factors include content tags, which may be applied todigital information by a content provider, a sensor producing thedigital information, or another entity. Such tags may for exampledescribe various attributes of the digital information, such as whetherthe digital information contains explicit images/language, carries aparticular parental guidance rating, etc. Various combinations of DRMselection factors may be cross referenced with one or more DRM policies,as noted above.

In operation client 101 may receive (e.g., with I/O 107) a contenttransmission request (CTR) 113 from content provider 102. Among otherthings, CTR 113 may include information regarding the category, type,level etc. of DI 114 and/or content provider 102, as well as contextualinformation relevant to DI 114 and/or content provider 102 (e.g., theidentity of content provider 102, the author of DI 114, the time of day,the location of transmission, etc.). While the present disclosureenvisions embodiments wherein the CTR is provided as a separate messageto client 101, the CTR may take other forms. For example, a CTR may takethe form of header information accompanying one or more packetsassociated with a stream of digital information from content provider102. Alternatively or additionally, a CTR may take the form of metadataappended to or otherwise associated with a transmission of digitalinformation from content provider 102.

In response to the CTR, PEM 109 may compare information in CTR 113 tothe DRM factors in the DRM selection policy, e.g., maintained inpolicies 110. Alternatively or additionally, PEM 109 may query sensors(not separately illustrated) and/or other resources (e.g., one or moreclassifiers, also not illustrated) of client 101 for information that itmay use to identify the DRM protocol that is to be implemented toprotect DI 114, such as contextual information relevant to client 101, auser thereof, software thereon, etc. For example, client 101 may includeone or more sensors which may be used to verify user presence, useridentity, client device location, user location, etc. Non-limitingexamples of such sensors include accelerometers, gyro meters,magnetometers, pressure sensors, temperature sensors, ambient lightsensors, infrared proximity sensors, wireless devices (BLUETOOTH®, nearfield communication, Wi-Fi, global positioning sensors, cameras,microphones, touch screens, biometric readers, combinations thereof, andthe like.

Such sensors may feed raw data into one or more classifiers which mayfunction to classify the raw data in accordance with the DRM factorsnoted above, e.g., to verify user presence. Such classifiers may beintegral to the sensor, integral to client 1010, or maintained in aseparate device. In such instances, PEM 109 may query suchsensors/classifiers to verify user presence, user identity, or someother contextual factor(s) relevant to determining which DRM protocol isto be implemented.

In any case, PEM 109 when executed may compare the information gleanedfrom CTR 113 and optionally from client 101 to the DRM selection factorsin the DRM selection policy. Based on this comparison (which mayinvolve, for example cross referencing information in CTR 113 and/orgleaned from client 101 against the DRM factors in the DRM selectionpolicy), PEM 109 may determine which of the plurality of DRM protocolsidentified in the DRM selection policy is to be implemented to protectdigital information 114.

Alternatively or additionally, CTR 113 or another message may specifywhich DRM protocol is to be implemented to protect digital information114. In such instances, the DRM protocol specification in CTR 113 oranother message may be understood to override the DRM selectionoperations of PEM 109. Alternatively, the DRM protocol specification maybe applied by PEM 109 to weight its determination of which DRM protocolis to be implemented. In any case, it should be understood that contentprovider 102 may use CTR to specify which DRM policy is to beimplemented to protect DI 114. In such instances PEM 109 may verify thatit has knowledge of the procedural requirements of the specified DRMpolicy, and that client 101 is in possession of the resources (hardware,software and/or otherwise) needed to implement the specified DRM policy.If not, PEM 109 may cause architectural enclave to send query contentprovider 102 and/or another party (e.g., a trusted third part, notshown) to provide a description of the procedural requirements (ifnecessary) and/or to provide any missing (non-hardware) resources thatmay be needed to implement the specified DRM policy. PEM 109 may thencause the architectural enclave to update its DRM selection database anda digital rights management (DRM) repository, which is described below.

Architectural enclave 108 may also include DRM repository 115, which maybe included in the DRM selection policy (i.e. within policies 110) orstored separately within the architectural enclave. In general, DRMrepository 115 may be a database or other data structure whichassociates each of the DRM protocols identified in the DRM selectionpolicy with resource requirements (specific resource allocation,specific memory requirements, other hardware requirements, keys,attestation information, etc.) that may be needed to implement suchprotocols in a secure processing environment, such as the secureinformation processing environments discussed later. For example, DRMrepository 115 may store one or more encryption keys, access policies,licenses, etc. in association with any or all of the DRM protocolsidentified therein. Furthermore DRM repository 115 may identifyattributes of a secure processing environment (e.g., type of clientdevice hosting the secure processing environment, the classificationlevel of the secure processing environment, etc.) that may be needed toimplement a particular DRM protocol.

Of course, the type and nature of these resource requirements andattributes may differ between DRM protocols. As may be appreciated, DRMrepository 115 may be updated as new DRM protocols that may be supportedby the client device are added, existing DRM protocols supported by theclient device are modified (e.g., updated), and/or existing DRMprotocols supported by the client device are removed. Similarly, DRMrepository may be updated as resources (e.g., keys, DRM software, etc.)needed to support a particular DRM protocol change.

Having determined which DRM protocol is to be implemented to protect DI114, PEM 109 when executed within the architectural enclave may examinethe information in DRM repository 115 to determine the resourcerequirements and/or attributes needed to implement the identified DRMprotocol in a secure processing environment. PEM 109 may then causearchitectural enclave 108 to determine whether a secure informationprocessing environment (SIPE) meeting those requirements is present onthe client device. That determination may be performed pursuant to theexecution of PEM 109 itself or by another module, such as an SIPEdetermination module also executed within architectural enclave 108 (notseparately illustrated).

An SIPE is as a secure processing environment (e.g., a memory enclave)which is configured with resources (e.g., processing, memory, keys,etc.) needed to implement one or more DRM protocols. Because suchresources are maintained in an SIPE, it may be difficult or impossiblefor a hacker or other third party to gain access to those resources inan effort to bypass the relevant DRM protocol. In this way, an SIPE issimilar to a hardware DRM module. Because an SIPE is implemented assecure processing environment (e.g., a memory enclave), however, it maynot suffer from the drawbacks associated with the limited resources in ahardware DRM module. Indeed, an SIPE may be flexibly provisioned withresources, which may include all or a portion of the processing, memory,and other resources of client 101. Moreover, SIPEs may be assignedand/or configured to meet various attribute requirements that may beimposed by a DRM protocol, such as a particular security level, digitalinformation type, employee type, etc. Thus, use of SIPEs can providegreat flexibility in how DRM protocols may be implemented on a clientdevice.

It should therefore be understood that a single client device may beconfigured with one or multiple different SIPE's wherein each SIPE isallocated the same or different resources and/or attributes. Byappropriately allocating resources and attributes, an SIPE may beconfigured to support one or more DRM protocols. By way of example, aclient device may be configured to include a first SIPE which isconfigured (e.g., allocated hardware, attributes and/or other resources)to support a first DRM protocol, as well as a second SIPE which isconfigured (e.g., allocated hardware, attributes and/or other resources)to support a second, different DRM protocol. As noted previously, thefirst and second DRM protocols may have different resource and/orattribute requirements, and thus it may be understood that the first andsecond SIPEs may be configured differently to support the particularrequirements of the first and second DRM protocols.

This concept is shown in FIG. 1, which depicts client 101 as includingSIPE 111 ₁ and SIPE 111 _(n). For the sake of clarity, FIG. 1 depictsclient 101 as only hosting two SIPEs, but it should be understood thatany number of SIPEs may be hosted on a client device. With this in mind,subscript n in FIG. 2 may be 0 or an integer greater than or equal to 2,thus illustrating that client 101 may include one, two, or more SIPEs.In some embodiments, the number of SIPEs that may be hosted by a clientmay correlate to the number of DRM protocols that client 101 is tosupport. In such instances it may be understood that each SIPE isconfigured to implement one of the DRM protocols that client 101 is tosupport.

The hardware and other resources needed to implement the first DRMprotocol may differ from those needed to implement the second DRMprotocol. For example, a first DRM protocol to be implemented using SIPE111 ₁ may specify the use of particular decryption keys, particular DRMsoftware, memory (e.g., buffer) resources, input output resources, etc.,as well as a particular clearance level (e.g., top secret). In contrast,another (e.g., second) DRM protocol to be implemented using SIPE 111_(n) may require the use of other resources, as well as a differentclearance level (e.g. unclassified). SIPE 111 ₁ and SIPE 111 _(n) may beallocated these resources, e.g., by architectural enclave 108 or anotherentity that can provision a secure processing environment on client 101.In sum, client 101 may be provisioned with a plurality of secureinformation processing environments, each of which may be allocatedresources needed to support one or more DRM protocols.

Various mechanisms for allocating/provisioning a secure processingenvironment with resources are known, and thus are not described indetail herein. By way of example, resources such as hardware, software,digital information, various keys (e.g., enclave sealing keys,encryption keys, decryption keys, secure session keys, etc.) and thelike may be provisioned utilizing the processes described inInternational Patent Application No. PCT/US13/44158 filed Jun. 4, 2013.Therefore in some embodiments, architectural enclave 108 may exchangeone or more keys over a secure control channel, wherein the key(s) maybe used to protect (via encryption) the communication of non-hardwareresources to an SIPE.

Using those or other methods, an architectural enclave or another entitymay provision an SIPE with the hardware and other resources that may berequired by a plurality of DRM protocols, including but not limited toany current or future version of WIDEVINE® DRM, Marlin DRM, Open MobileAlliance (OMA) DRM, MICROSOFT® PLAYREADY®, advanced access contentsystem (AACS) protocol, Windows Media DRM, high definition contentprotection, protected audio video path, digital transmission contentprotection (DTCP), digital transmission content protection mapped tointernet protocol (DTCP-IP), combinations thereof, and the like. Theaforementioned DRM protocols are of course exemplary, and any suitableDRM protocol may be implemented in an SIPE on a client device, providedthe SIPE may be provisioned with the appropriate resources.

As implied by the forgoing discussion, one general function of an SIPEis to execute various operations in accordance with a DRM protocol(hereinafter, DRM operations). In this regard, SIPE 111 ₁ and SIPE 111_(n) may include DRM enforcement module (DRMEM) 112 ₁ and 112 _(n),respectively. DRMEMs 112 ₁, 112 _(n) may be provided by architecturalenclave 108, another source (e.g., a trusted third part), and/or acontent provider such as content provider 102. In general, a DRMEM whenexecuted may cause an SIPE to execute DRM operations in accordance witha DRM protocol, utilizing the resources that were allocated to the SIPE,e.g., by an architectural enclave or another SIPE provisioning entity.More specifically, a SIPE may utilize the resources allocated to it toprocess digital information (e.g., DI 114) in accordance with the DRMprotocol and/or protocols that the SIPE is configured to support. Thusfor example, a SIPE 111 ₁ and DRMEM 112 ₁ may be configured to processdigital information 114 in accordance with a first DRM protocol, whereasa SIPE 111 _(n) and DRMEM 112 _(n) may be configured to process digitalinformation in accordance with a second, different DRM protocol.

As used herein, the terms “process” and “processing” when used inconjunction with operations performed by an SIPE in associated withdigital information refer to operations that the SIPE (or, morespecifically a DRMEM executed within an SIPE) may perform pursuant to aDRM protocol that the SIPE is configured to support. Such operations mayinclude, for example, attesting the identity of the SIPE to a contentprovider, exchanging one or more keys with the content provider (and/orobtaining relevant keys from digital rights management repository 115),decrypting digital information received from content provider 102 (whichmay be encrypted with a first encryption key) to obtain plaintext,demodulating the plaintext digital information (e.g., where DI 114includes modulated audio, video and/or other signals), decoding theplaintext to obtain decoded digital information, re-encoding the decodeddigital information (e.g., where a DRM protocol requires transcoding toa specific format), encrypting digital information for storage, sealingdigital information to an SIPE, combinations thereof, and the like.

In some embodiments a DRM protocol may specify that digital informationis to employ displayed using secure media hardware. In such instances,“processing” may further include encrypting digital information forsecure output and/or display on media hardware. By way of example, aDRMEM may be configured to encrypt digital information with one or morekeys, e.g. as may be used in secure audio video path technology such asINTEL protected audio video path (PAVP) technology. Likewise, an SIPEmay be configured to encrypt digital information for secure display,e.g., using one or more keys as may be used in high definition contentprotection (HDCP) or another secure display protocol.

In one example, a DRM protocol (e.g. PAVP, IEEE 1667 (versions in forceprior to and after the filing of this disclosure), etc.) may specifythat digital content provided to an SIPE is to be protected before it isoutput to another device, such as a graphics processing unit (GPU). Suchprotocol may require partitioning of the GPU resource, which may beperformed using an administrative console/utility executed within AE108. The protocol may further require establishing a secure channelbetween the GPU and an SIPE using one or more keys. In such instance, amodule in architectural enclave 108 may exchange the key(s) need toestablish the secure channel with the relevant SIPE. The SIPE may thenencrypt the digital content for output to the GPU using the provisionedkey(s).

Accordingly, the client devices of the present disclosure employ anarchitectural enclave that includes a module (e.g., PEM or otherwise),which may determine which of a plurality of DRM protocols is to beimplemented to protect digital information. Having identified the DRMprotocol that will be used, the architectural enclave may furtherdetermine whether a preexisting SIPE on the client device (if any) isconfigured to support the identified DRM protocol. If not, thearchitectural enclave may generate or spawn a new SIPE on the clientdevice, and provision that new SIPE with resources that may be needed toperform the identified DRM protocol.

If an architectural enclave and/or the preexisting/new SIPE lacknon-hardware resources which may be needed to implement the identifiedDRM protocol, it may request such resources from a content providerand/or another entity, such as a trusted third party. By way of example,an architectural enclave may include a digital rights managementrepository that lacks one or more keys used in the implementation of aDRM protocol. As a result, the architectural enclave may not be able toprovision a new or preexisting SIPE with the keys needed to support thatDRM protocol.

To address this issue, the architectural enclave and/or identified SIPE(or more particularly, a module in such secure environments) may causeits host client to send a message (e.g., a DRM information requestmessage) to a content provider or other party, requesting the neededinformation (in this case, keys). Once the needed information (keys) isreceived from the content provider and/or other party, the architecturalenclave may update its digital rights management repository with thereceived information (keys), and may provision the information (keys) tothe identified SIPE. Alternatively or additionally, the identified SIPEmay receive the needed information directly from the content provider orother source.

Once a preexisting or new SIPE has been identified as being configuredto implement an identified DRM protocol, communication of the digitalinformation in question may be directed to the identified SIPE. In thisregard and referring again to FIG. 1, architectural enclave 108 may senda message (e.g., an SIPE identification message) that identifies whichSIPE (e.g. SIPE 111 ₁) content provider 102 is to transmit digitalinformation 114. Alternatively or additionally, the DRM enforcementmodule of the identified SIPE (e.g., DRMEM 112 ₁) when executed mayestablish communication with content provider 102 using communicationresources (e.g., I/O 107) allocated to it. Content provider 102 may thentransmit messages containing DI 114 to the identified SIPE, in this caseSIPE 111 ₁, for processing in accordance with the identified DRMprotocol. In instances where secure communication between client 101 andcontent provider is desired, architectural enclave 108 and/or SIPEs 111₁, 111 _(n) may negotiate a secure communications channel with contentprovider 102. Negotiation of the secure communications channel may beperformed in accordance with any suitable secure communicationsprotocol, such as the transport layer security (TLS) protocol, a signand message authentication code (SIGMA) protocol, an asymmetric orsymmetric encryption protocol, combinations thereof, and the like.

In any case, content provider 102 may transmit DI 114 to client 101 (or,more particularly, to a selected SIPE such as SIPE 111 ₁) for processingin accordance with an identified DRM protocol. To protect DI 114 duringtransmission, content provider may encrypt DI 114 using a firstencryption protocol, such as but not limited to a public key encryptionprotocol, a symmetric key encryption protocol, an asymmetric keyencryption protocol, etc. In general, the first encryption protocol mayconvert the plaintext of the digital information to cipher text usingone or more keys. With this in mind, a selected SIPE in client 101 maybe provisioned with an appropriate key needed to decrypt the encrypteddigital information, so as to obtain its plaintext within a secureprocessing environment.

Once the plaintext of the digital information is obtained, the selectedSIPE may execute DRM operations to process the digital information in amanner consistent with the DRM protocol it is configured to support. Asnoted previously, such operations may include demodulating the plaintextto obtain demodulated plaintext, re-modulating the demodulated plaintext(e.g., in accordance with a specified output), decoding the plaintext toobtain decoded plaintext, encoding or re-encoding the plaintext (e.g.into a different format), encrypting the plaintext (e.g., with one ormore keys that may be used in accordance with a protected audio videoprotocol such as high definition content protection, INTEL® protectedaudio video path, etc.), establishing a secure communications link witha downstream device (e.g., using TLS, SIGMA, Internet protocol security(IPSEC), PKSC12 cryptography, other message/channel encryption or keyencryption operations, combinations thereof and the like.

Reference is now made to FIG. 2, which is a flow chart of exemplaryoperations that may be performed in accordance with one example methodof supporting multiple digital rights management protocols on a clientdevice, consistent with the present disclosure. As shown, method 200begins at block 201. The method may then proceed to optional block 202,wherein a client device may optionally request digital information froma content provider. Such a request may be initiated, e.g., via a userinterface or another mechanism as may be understood in the art. In someembodiments, a client device may request digital information by sendingone or more digital information requests to a content provider. Inresponse to the digital information request, a content provider mayoptionally verify the authenticity of the request and/or the identity ofthe client device, e.g. using one or more verification protocols such asdirect anonymous attestation, enhanced privacy ID, or the like.

In any case the method may proceed to block 203, wherein a client devicemay monitor for the receipt of a content transmission request (CTR)message from a content provider. As noted previously, a CTR may containinformation that may be used by a policy enforcement module executedwithin an architectural enclave of a client device to determine which ofa plurality of DRM protocols is to be implemented to protect digitalinformation. Alternatively or additionally, a CTR may specify that aparticular DRM protocol is to be implemented with respect to certaindigital information. Accordingly, a CTR may include an identifier of thedigital information to be transmitted, as well as information pertinentto DRM factors (e.g., which may be stored in a DRM selection policy, aDRM repository, etc.), and optionally an identifier of a specific DRMprotocol to be used.

At block 204, a determination may be made as to whether a CTR has beenreceived. If not, the method may loop back to block 203, whereupon aclient device may continue to monitory for receipt of a CTR. Uponreceipt of a CTR, the method may proceed to block 205, wherein a clientdevice may analyze information in the CTR against DRM selection factorsin one or more policies, such as a DRM selection policy, as discussedabove. Consistent with the foregoing discussion, such analysis may beperformed pursuant to the execution of a policy enforcement module withan architectural enclave hosted by the client device. From thisanalysis, a determination as to which of a plurality of DRM protocolswill be implemented to protect the digital information that is to bereceived by the client device.

The method may then proceed to block 206, wherein a determination may bemade as to whether a preexisting SIPE is hosted by the client device,and is configured to support the identified DRM protocol. As generallydiscussed above, this determination may be made pursuant to theexecution of one or more modules (e.g., policy enforcement module, SIPEselection module, etc.) executed within an architectural enclave hostedby the client device.

If no suitable preexisting SIPE is present, the method may proceed tooptional block 207, wherein an architectural enclave (and/or moduleexecuted therein) may query a content provider and/or other party toidentify and/or provide the resource requirements that may be needed toimplement the identified DRM protocol. As may be appreciated, optionalblock 207 may be omitted where an architectural enclave is aware of thehardware and other requirements needed to implement the identified DRMprotocol, and is in possession/control of such resources.

In any case the method may proceed to block 208, wherein anarchitectural enclave (or module executed therein) may generate or“spawn” a new SIPE on the client device, and new SIPE may be provisioned(by the architectural enclave or another entity) with the resourcesneeded to implement the identified DRM protocol. For example, thearchitectural enclave may partition processing and memory resources onthe client to a new SIPE. The architectural enclave may then provisionthe new SIPE with secrets (e.g., keys, etc.) and other resources(modules, software, etc.) that may be needed to implement the identifiedDRM protocol within the new SIPE.

Once the new SIPE is created (or if a preexisting SIPE configured tosupport the identified DRM protocol is present on the client device),the method may proceed to block 209, wherein the architectural enclavemay select the preexisting or new SIPE for use in processing digitalinformation in accordance with the identified DRM protocol. Transmissionof the digital information may then be directed to the selected SIPE, asgenerally described above.

The method may then proceed to block 210, wherein the client device mayreceive digital information, e.g., from a content provider or anothersource. More particularly, the digital information may be received intothe SIPE that was selected pursuant to block 209. The method may thenproceed to block 211, wherein the selected SIPE may process the digitalinformation in accordance with the DRM protocol(s) it is configured toimplement. As discussed previously, such processing may involve one ormore of: decrypting digital information to obtain plaintext,demodulating the plaintext, decoding the plaintext, encoding orre-encoding the plaintext, modulating plaintext, sealing plaintext tothe SIPE (e.g. by encrypting the plaintext with an SIPE sealing key(e.g., an enclave sealing key)), processing the digital information (asmodulated, encoded, etc.), outputting the digital information forconsumption on media HW of the client device (e.g., a display, speakers,etc.), combinations thereof, and the like. As may be appreciated, themanner in which a SIPE processes digital information may be specific tothe DRM protocol that is being implemented, and thus the order, nature,and implementation of any of the above noted exemplary operations mayvary from one DRM protocol to another and hence, from one SIPE toanother.

Once the digital information is processed pursuant to block 211, themethod may proceed to block 212 and end.

By way of example, Rights Object Acquisition Protocol is a suite ofXML-based Digital Rights Management (DRM) security protocols whichenables Open Mobile Alliance-conformant user devices to request andacquire viewing and/or editing rights, permissions, privileges and otherattributes from a Rights Issuer. This protocol is been specified in theopen mobile alliance (OMA) DRM Specification v2.0. In this context,content provider 102 or another third party may serve as a rights issuerin an OMA DRM model.

With the foregoing in mind, content provider 102 or a third party mayestablish a connection with client 101 (or more particularly, withdevice platform 104) using a rights object acquisition protocol (ROAP)in connection with a rights provisioning request. An agent (notillustrated) in 105 observes that a content transmission request (whichmay itself be in the form of a policy) is to be provisioned by contentprovider 102 or the third party. The agent may request thatarchitectural enclave 108 (or, more particularly, PEM 109) service therequest. Architectural enclave 108 may analyze content of the CTR/policyand determine that certain restraints are required by content provider102 (or a third party) to protect digital information to be supplied.For example, PEM 109 may determine from the policy that constraints suchas content class-A processing is required. At this point, architecturalenclave 108 may determine whether a suitable preexisting SIPE exists onclient 101 and, if not, may construct a suitable new SIPE provisionedwith privilege “class-A”. Another CTR/policy may result inselection/creation of a second SIPE with other privileges, e.g., forprocessing content “class-B” digital information. For the sake ofillustration SIPE 111 ₁ will be considered suitable for “class-A” andSIPE 111 _(n) will be considered suitable for “class-B.”

Assuming that content provider 102 is to provide the digitalinformation, content provider 102 may open a second connection to client101/device platform 104, and assert an OMA-DRM digital informationstream protected using a ‘class-A’ specific key. PEM 109 within AE 108may forward/proxy the connection to SIPE 111 ₁ AE 108 forwards/proxiesthe connection to SIPE 111 ₁ where digital information packets/framesmay be decrypted using a class-A key, which was previously provisionedto SIPE 111 ₁ by architectural enclave 108, content provider 102, orother entity.

The resulting plaintext packets/frames of the digital information may bereencrypted (e.g., pursuant to the execution of DRMEM 112 ₁) to usingclass-A secure channel key(s) (e.g. a PAVP or IEEE1667 channel key(s)),and SIPE 111 ₁ may then output the reencrypted packets/frames tocompatible downstream media hardware (assuming the rest of policies 110are satisfied).

While the foregoing discussion focuses on the implementation of multipleDRM protocols with a client device that receives digital informationfrom content provider such as a recording medium, content server, etc.,it should be understood that the technologies described herein may beapplied in other contexts as well. For example, the technologiesdescribed herein may be used to implement a variety of DRM protocols toprotect digital information that may be created by one or more sensorscoupled to a client device. In this way, the sensors coupled to a clientdevice may be considered comparable to a content provider, in that theyprovide digital information and/or data which may be compiled intodigital information to client 101.

As will be described later with reference to FIGS. 3 and 4, thetechnologies described herein may employ an architectural enclave todetermine which of a plurality of DRM protocols is to be implemented toprotect digital information received from a sensor, and/or digitalinformation which may be compiled from sensor data received from one ormore sensors. Having determined which DRM protocol is to be implemented,the architectural enclave may select a preexisting secure informationprocessing environment (SIPE) on the client device for implementing theidentified DRM protocol, if a suitable preexisting SIPE exists on theclient. If a suitable preexisting SIPE does not exist, the architecturalenclave may generate or “spawn” a suitable new SIPE, as generallydiscussed above, and select the new SIPE to implement the identified DRMprotocol to protect the digital information and/or sensor data receivedfrom one or more sensors. Digital information from the sensor(s) maythen be transmitted to the selected SIPE, which may process it inaccordance with an appropriate DRM protocol.

Reference is now made to FIG. 3, which depicts an exemplary system forsupporting multiple DRM protocols with another example of a clientdevice consistent with the present disclosure. As shown, system 300includes client 101, which is configured to include many of the samecomponents as client 101 of FIG. 1. For the sake of brevity a detaileddescription of various components of client 101 and their functions isnot provided again, except insofar as the components in FIG. 3 maydiffer in form and/or function with the components previously describedin connection with FIG. 1

As further shown in FIG. 3, system 300 may include a plurality ofsensors, such as sensor 301 ₁ and Sensor 301 _(n), where n is 0 or aninteger greater than or equal to 2. FIG. 3 may therefore be understoodas depicting a system wherein 1 or a plurality of sensors (e.g., 2, 3,4, 5, 10, etc.). Sensors 301 ₁, 301 _(n) may be integral with, coupledto, or otherwise in communication with client 101, such that they maytransmit one or more messages including sensor data (302 ₁, 302 _(n))and/or other information such sensor data attributes 302 ₁, 303 _(n) toclient 101.

Sensors 301 ₁ and 301 _(n) may be any sensor that may produce sensordata and provide such data to client 101, such as those mentioned abovein connection with the description of FIG. 1. In some embodiments,Sensors 301 ₁, 301 _(n) may be one or more of an image sensor (e.g. avideo camera or a still camera), an audio sensor (e.g., a microphone), atemperature sensor, a location (e.g., global positioning) sensor, abiometric sensor (e.g., fingerprint scanner, retinal scanner,deoxyribonucleic acid analyzer, facial recognition system, etc.), achemical sensor, a radiation sensor, a range detection sensor, apressure sensor, an input monitoring system (e.g., for monitoring one ormore input/output devices), a network sensor, combinations thereof, andthe like. Without limitation sensor 301 ₁ is preferably a video sensorand sensor 301 _(n) is preferably an audio sensor, e.g., as may be foundin an audio visual recording system such as a video camera. In someembodiments, sensors 301 ₁ and 301 _(n) are both an audio visualrecording system such as a video camera.

Any or all of the sensors in communication with client 101 may beassociated with one or more sensor data attributes, which indicate thetype, category, level, etc. of their respective sensor data. By way ofexample, it may be known that sensor 301 ₁ records sensor data of afirst security level (e.g., top secret) whereas sensor 301 _(n) recordssensor data of a second security level (e.g., unclassified). Similarly,sensor data from different sensors may be associated with differenttypes of employees, businesses, different types of networks, differentcontextual information (e.g., relevant to where and/or how the sensordata is gathered, etc.). Sensor data attributes may in some embodimentsinclude a DRM identifier, which identifies which DRM policy should beimplemented to protect sensor data associated with the sensor dataattributes. As will be described later, sensor data attributes may beused by one or more modules executed in an architectural enclave of aclient device to determine which of a plurality of DRM protocols will beimplemented to protect sensor data (or digital information compiledtherefrom) received from one or more sensors.

Sensor data attributes may be conveyed to a client device in anysuitable manner. For example, sensor data attributes may be transmittedto a client device with one or more sensor attribute messages, which maybe conveyed via a suitable wireless or wired communication link betweena sensor and a client device. Alternatively or additionally, sensorattributes may be appended as header and/or metadata that is/areassociated with a transmission of sensor data to a client.

The above noted concepts are illustrated in FIG. 3, which depictssensors 301 ₁, 301 _(n) as transmitting sensor data 302 ₁ and 302 _(n),respectively, to client 101. In this embodiment, sensor data 302 ₁, 302_(n) each include sensor data attributes 303 ₁, 303 _(n), e.g., in theform of header data (e.g., where communication of sensor data 302 ₁, 302_(n) is made via a packetized stream) and/or metadata, as previouslydescribed. Of course, sensor data attributes 303 ₁, 303 _(n) need not becommunicated to client 101 in this manner. Indeed, the presentdisclosure envisions embodiments wherein sensor data attributes 303 ₁,303 _(n) are transmitted separately from sensor data 302 ₁, 302 _(n),e.g., in one or more sensor data attribute messages.

Reference is now made to FIG. 4, which depicts exemplary operations thatmay be performed in connection with an example method of supportingmultiple DRM protocols with a client device, such as client 101 of FIG.3. As shown, method 400 begins at block 401. The method may then proceedto optional block 402, wherein a client device such as client 101 mayoptionally initiate gathering of sensor data, e.g., by sensors 301 ₁,301 _(n). In some embodiments, a user of client 101 may initiategathering of sensor data by making inputs to client 101, e.g., via auser interface provided thereon. Alternatively or additionally,initiation of sensor data gathering may be performed by an applicationexecuted on client 101.

In some embodiments, client device 101 may initiate sensor datagathering by sending one or more sensor data requests to a sensor, suchas sensors 301 ₁, 301 _(n). In response to such request(s), thesensor(s) may optionally verify the authenticity of the request and/orthe identity of the client device, e.g. using one or more verificationprotocols such as direct anonymous attestation, enhanced privacy ID, orthe like. Such verification may be particularly useful in instanceswhere one or more of sensors 301 ₁, 301 _(n) is a secured sensor, and/orforms part of a secured system.

In any case the method may proceed to block 403, wherein client devicemay monitor for the receipt of sensor data attributes from one or moresensors. For example, client 101 may monitor for the receipt of sensordata attributes messages from sensors 301 ₁, 301 _(n), which may be inthe form of separate messages and/or header/metadata associated with atransmission of sensor data Like the information in a CTR discussedabove with regard to FIG. 1, sensor data attributes messages may containinformation that may be used by a policy enforcement module executedwithin an architectural enclave of a client device (e.g., architecturalenclave 108) to determine which of a plurality of DRM protocols is to beimplemented to protect sensor data provided by one or more sensors(e.g., sensors 301 ₁, 301 _(n)) digital information. Alternatively oradditionally, sensor data attributes may specify that a particular DRMprotocol is to be implemented with respect to certain digitalinformation as noted previously. Accordingly, sensor data attributesreceived from one or more sensors may include an identifier of thedigital information to be transmitted, as well as information pertinentto DRM factors (e.g., which may be stored in a DRM selection policy, aDRM repository, etc.), and optionally an identifier of a specific DRMprotocol to be used.

At block 404, a determination may be made as to whether sensor dataattributes have been received. If not, the method may loop back to block403, whereupon a client device may continue to monitory for receipt ofsuch attributes. Upon receipt of sensor data attributes the method mayproceed to block 205, wherein a client device (e.g., client 101) mayanalyze information in the sensor data attributes against DRM selectionfactors in one or more policies, such as a DRM selection policymaintained in policies 110. This analysis may be performed insubstantially the same manner as discussed above with respect to theanalysis of CTR information in the system of FIG. 1. Consistent with theforegoing discussion, such analysis may be performed pursuant to theexecution of a policy enforcement module with an architectural enclavehosted by the client device, e.g., architectural enclave 108. From thisanalysis, a determination as to which of a plurality of DRM protocolswill be implemented to protect sensor data (and/or digital informationcompiled therefrom) that will be received by the client device.

The method may then proceed to block 406, wherein a determination may bemade as to whether a preexisting SIPE is hosted by the client device,and is configured to support the identified DRM protocol. Consistentwith the discussion of FIGS. 1 and 2 above, this determination may bemade pursuant to the execution of one or more modules (e.g., policyenforcement module 109, SIPE selection module, etc.) executed within anarchitectural enclave 108 hosted by client 101.

If no suitable preexisting SIPE is present, the method may proceed tooptional block 407, wherein architectural enclave 108 (and/or moduleexecuted therein) of client 101 may query sensor(s) 301 ₁, 301 _(n)and/or another party to identify and/or provide the resourcerequirements that may be needed to implement the identified DRMprotocol. As may be appreciated, optional block 407 may be omitted whenarchitectural enclave 108 is aware of the hardware and otherrequirements needed to implement the identified DRM protocol, and is inpossession/control of such resources.

In any case the method may proceed to block 408, wherein architecturalenclave 108 (or module executed therein) may generate or “spawn” a newSIPE on client 101, and new SIPE may be provisioned (by architecturalenclave 108 or another entity) with the resources needed to implementthe identified DRM protocol. For example, architectural enclave 108 maypartition processing and memory resources of client 101 to a new SIPE.It may then provision the new SIPE with secrets (e.g., keys, etc.) andother resources (modules, software, etc.) that may be needed toimplement the identified DRM protocol within the new SIPE.

Once the new SIPE is created (or if a preexisting SIPE configured tosupport the identified DRM protocol is present on the client device),the method may proceed to block 209, wherein architectural enclave 108(or a module executed thereon) may select the preexisting or new SIPEfor use in processing sensor data in accordance with the identified DRMprotocol. Transmission of sensor data 302 ₁, 302 ₂ may then be directedto the selected SIPE, as generally described above.

The method may then proceed to block 410, wherein client device 101 mayreceive sensor data 302 ₁, 302 _(n) from sensors 301 ₁, 301 ₂. Moreparticularly, the sensor data may be received into the SIPE that wasselected pursuant to block 309. The method may then proceed to block311, wherein the selected SIPE may process the sensor data in accordancewith the DRM protocol(s) it is configured to implement. Consistent withthe foregoing discussion regarding the processing of digitalinformation, the SIPE may process sensor data by performing one or moreof the following: decrypting sensor data (e.g., when it is received inencrypted form) to obtain plaintext, demodulating the plaintext,decoding the plaintext, encoding the plaintext, modulating re-encodedplaintext, sealing plaintext to the SIPE (e.g. by encrypting theplaintext with an SIPE sealing key (e.g., an enclave sealing key)),processing the sensor data (as modulated, encoded, etc.), outputting thesensor data for consumption on media HW of the client device (e.g., adisplay, speakers, etc.), combinations thereof, and the like. As may beappreciated, the manner in which a SIPE processes sensor data may bespecific to the DRM protocol that is being implemented, and thus theorder, nature, and implementation of any of the above noted exemplaryoperations may vary from one DRM protocol to another and hence, from oneSIPE to another.

Alternatively or in addition to the foregoing operations, an SIPE mayexecute sensor data compilation operations, which may compile sensordata from different sensors into digital information. For example, anSIPE may compile video data from sensor 201 ₁ and audio data from sensor201 _(n) into digital information including both the audio and visualdata. Processing operations may then proceed on the compiled digitalinformation in substantially the same way as discussed previously.

Once the sensor data and/or digital information are processed pursuantto block 411, the method may proceed to block 412 and end.

By way of example, client 101 may establish a secure communicationschannel with one or more sensors, such as sensors 301 ₁, 301 _(n) usingone or more channel encryption keys, as may be used in PAVP, IEEE 1667,or another protocol. Though that channel, client 101 may receivemessages containing sensor data attributes (303 ₁, 303 _(n)), which maydescribe the attributes of sensor data 302 ₁, 302 _(n) to be provided bysensors 301 ₁, 301 _(n). An agent within processor 105 may observe theincoming transmission of sensor data attributes, and direct it toarchitectural enclave 108 for processing.

Sensor data attributes 303 ₁ may specify that sensor data 302 ₁ is“class-A” data, whereas sensor data 302 _(n) is “class-B” data. PEM 109may analyze the sensor data attributes and determine that relevant DRMprotocols require constraints such as content class-A storage andprocessing, and content class B storage and processing. PEM 109 may thendetermine whether a preexisting SIPE is present on client 101 that canservice the class-A or class B data in accordance with the identifiedDRM protocols. If not, PEM 109 may cause architectural enclave 108 togenerate one or more new SIPEs on client 101 for servicing class-A andclass-B sensor data.

Once a suitable SIPE has been selected/created, PEM 109 withinarchitectural enclave may forward/proxy transmission of encryptedpackets/frames of sensor data 111 ₁ and 111 _(n) to appropriate SIPEs,namely SIPE 111 ₁ and SIPE 111 _(n) for processing. Such transmissionmay occur over the same or a different connection as the transmission ofsensor data attributes 302 ₁, 302 _(n). The SIPEs may decrypt theencrypted packets/frames to obtain their plaintext, e.g., using anappropriate decryption key which may have been previously provisioned tothe SIPE. The SIPEs may then manipulate the plaintext as specified bythe relevant DRM protocol, prior to storing it (e.g., sealing it to therelevant SIPE) or outputting it to another device.

As may be appreciated from the foregoing, the technologies of thepresent disclosure may harden the security of digital information,sensor data, etc. by maintaining that information and assets associatedwith a plurality of DRM protocols in one or more secure processingenvironments. Moreover, the technologies may leverage the flexiblenature of the secure processing environments to support a wide varietyof DRM protocols, e.g., by with one or more secure informationprocessing environments (SIPEs). Because an SIPE may be flexiblyprovisioned with different hardware and non-hardware assets, it mayperform many or all of the same functions of a hardware DRM module, butmay avoid the drawbacks associated with the fixed resources andconfigurations of a hardware DRM module.

EXAMPLES

The following examples pertain to further embodiments. The followingexamples of the present disclosure may comprise subject material such asa system, a device, a method, a computer readable storage medium storinginstructions that when executed cause a machine to perform acts based onthe method, and/or means for performing acts based on the method, asprovided below.

Example 1

According to this example there is provided a client device to support aplurality of digital rights management (DRM) protocols, including aprocessor, at least one architectural enclave, and at least one policyenforcement module (PEM) stored and executed within the architecturalenclave, wherein the PEM is to: identify a first DRM protocol from aplurality of DRM protocols, wherein the first DRM protocol is to protectdigital information received from at least one of a content provider anda sensor, select a preexisting secure information processing environment(SIPE) supporting the first DRM protocol for processing the firstdigital information, when a preexisting SIPE supporting the first DRMprotocol exists on the client device; and create and select a new SIPEsupporting the first DRM protocol on the client device for processingthe first digital information, when a preexisting SIPE supporting thefirst DRM protocol does not exist on the client device.

Example 2

This example includes any or all of the elements of example 1, whereinthe architectural enclave, the preexisting SIPE, and the new SIPE areeach a memory enclave.

Example 3

This example includes any or all of the elements of any one of examples1 to 3, wherein the client includes a plurality of preexisting secureinformation processing environments (SIPEs), wherein each of the SIPEsis configured to support a different one of the plurality of DRMprotocols.

Example 4

This example includes any or all of the elements of any one of examples1 to 3, wherein the client device further includes a digital rightsmanagement (DRM) repository in the architectural enclave, the DRMrepository including a data structure associating at least a DRMidentifier of the first DRM protocol with of requirements and resourcesneeded to execute the first DRM protocol.

Example 5

This example includes any or all of the elements of example 4, whereinthe PEM is further to determine whether the pre-existing SIPE supportingthe first DRM protocol is present on the client device at least in partby: comparing the requirements associated with the DRM identifiercorrelating to the first DRM protocol to the configuration of eachpreexisting SIPE on the client device; and identifying a firstpreexisting SIPE as supporting the first DRM protocol if theconfiguration of the first preexisting SIPE meets the requirementsassociated with the DRM identifier correlating to the first DRMprotocol.

Example 6

This example includes any or all of the elements of example 3, whereinthe PEM is further to request resources needed to implement the firstDRM protocol, when the resources are not present in the preexistingSIPE, new SIPE, or the DRM repository.

Example 7

This example includes any or all of the elements of any one of examples1 to 6, wherein the digital information from the sensor includes sensordata.

Example 8

This example includes any or all of the elements of any one of examples1 to 7, further including a plurality of preexisting secure informationprocessing environments (SIPEs), wherein each of the preexisting SIPEsis configured to support a different one of the plurality of DRMprotocols.

Example 9

This example includes any or all of the elements of any one of examples1 to 8, further including a digital rights management enforcement module(DRMEM) to execute within at least one of the preexisting SIPE and thenew SIPE, the DRMEM to perform digital rights management operationsconsistent with the first DRM protocol within the preexisting SIPE, thenew SIPE, or a combination thereof.

Example 10

This example includes any or all of the elements of example 9, whereinthe digital rights management operations comprise at least one of:decrypting the digital information, demodulating the digitalinformation, decoding the digital information, encoding the digitalinformation, encrypting the digital information, and combinationsthereof.

Example 11

This example includes any or all of the elements of example 10, whereinthe DRM operations comprise processing the digital information forsecure video output.

Example 12

This example includes any or all of the elements of example 11, whereinprocessing the digital information for secure video output includesprocessing the digital information to comply with a protected audiovideo protocol.

Example 13

This example includes any or all of the elements of example 12, whereinthe protected audio video protocol is selected from the group consistingof a high definition content protection (HDCP) protocol and a protectedaudio video path protocol.

Example 14

This example includes any or all of the elements of any one of examples1 to 13, wherein the plurality of DRM protocols includes an advancedaudio content system (AACS) protocol, a high definition contentprotection protocol, a digital transmission content protection (DTCP)protocol, a digital transmission content protection mapped to internetprotocol (DTCP-IP), and combinations thereof.

Example 15

This example includes any or all of the elements of example 4, whereinthe client is to receive the digital information from a contentprovider, and the PEM is further to: identify the first DRM protocol atleast in part by comparing information in a content transmission requestfrom the content provider to the DRM repository; direct transmission ofthe digital information from the content provider to the preexistingSIPE when a preexisting SIPE supporting the first DRM protocol ispresent on the client device; and direct transmission of the digitalinformation from the content provider to the new SIPE, when apreexisting SIPE supporting the first DRM protocol is not present on theclient device.

Example 16

This example includes any or all of the elements of example 15, whereinthe content provider is a content server, a recording medium andcombinations thereof.

Example 17

This example includes any or all of the elements of any one of examples1 to 16, wherein the client is to receive the digital information from asensor, and the PEM is to: identify the first DRM protocol at least inpart by analyzing sensor data attributes received from the sensor;direct transmission of the digital information from the sensor to thepreexisting SIPE when a preexisting SIPE supporting the first DRMprotocol is present on the client device; and direct transmission of thedigital information from the sensor to the new SIPE, when a preexistingSIPE supporting the first DRM protocol is not present on the clientdevice.

Example 18

According to this example there is provided a method for supporting aplurality of digital rights management (DRM) protocols with a clientdevice, the client device including an architectural enclave having apolicy enforcement module stored and executed therein, wherein themethod includes: identifying a first DRM protocol of the plurality ofDRM protocols, the first DRM protocol to protect the digital informationreceived by the client device from at least one of a content providerand a sensor; selecting a preexisting secure information processingenvironment (SIPE) supporting the first DRM protocol for processing thefirst digital information, when a preexisting SIPE supporting the firstDRM protocol exists on the client device; and creating and selecting anew SIPE supporting the first DRM protocol on the client device forprocessing the first digital information, when a preexisting SIPEsupporting the first DRM protocol does not exist on the client device.

Example 19

This example includes any or all of the elements of example 18, whereinthe architectural enclave, the preexisting SIPE, and the new SIPE areeach a memory enclave.

Example 20

This example includes any or all of the elements of any one of examples18 and 19, wherein the client includes a plurality of preexisting secureinformation processing environments (SIPEs), wherein each of the SIPEsis configured to support a different one of the plurality of DRMprotocols, and the method includes determining whether at least one ofthe preexisting SIPEs supports said first DRM protocol.

Example 21

This example includes any or all of the elements of any one of examples18 to 20, wherein the client device further includes a digital rightsmanagement (DRM) repository in the architectural enclave, the DRMrepository including a data structure associating at least a DRMidentifier of the first DRM protocol with at least one of requirementsand resources needed to execute the first DRM protocol, and the methodfurther includes determining whether a pre-existing SIPE supporting thefirst DRM protocol is present on the client device at least in part by:comparing the requirements associated with the DRM identifiercorrelating to the first DRM protocol to the configuration of eachpreexisting SIPE on the client device; and identifying a firstpreexisting SIPE as supporting the first DRM protocol if theconfiguration of the first preexisting SIPE meets the requirementsassociated with the DRM identifier correlating to the first DRMprotocol.

Example 22

This example includes any or all of the elements of example 21, furtherincluding: requesting resources needed to implement the first DRMprotocol from the content provider, the sensor, a trusted third party,or combination thereof, when the resources are not present in thepreexisting SIPE, new SIPE, or the DRM repository.

Example 23

This example includes any or all of the elements of any one of examples18 to 22, wherein the digital information from the sensor includessensor data.

Example 24

This example includes any or all of the elements of example 23, whereinsaid sensor data includes local context relevant to said client device.

Example 25

This example includes any or all of the elements of any one of examples18 to 24, wherein the client device includes a plurality of preexistingsecure information processing environments (SIPEs), wherein each of thepreexisting SIPEs is configured to support a different one of theplurality of DRM protocols.

Example 26

This example includes any or all of the elements of any one of examples18 to 25, further including a digital rights management enforcementmodule (DRMEM) to execute within at least one of the preexisting SIPEand the new SIPE, the method further including performing digital rightsmanagement operations consistent with the first DRM protocol at least inpart with the DRMEM, and within the preexisting SIPE, the new SIPE, or acombination thereof.

Example 27

This example includes any or all of the elements of example 26, whereinthe digital rights management operations comprise at least one of:decrypting the digital information, demodulating the digitalinformation, decoding the digital information, encoding the digitalinformation, encrypting the digital information, and combinationsthereof.

Example 28

This example includes any or all of the elements of example 26, whereinthe DRM operations comprise processing the digital information forsecure video output.

Example 29

This example includes any or all of the elements of example 28, whereinprocessing the digital information for secure video output includesprocessing the digital information to comply with a protected audiovideo protocol.

Example 30

This example includes any or all of the elements of example 30, whereinthe protected audio video protocol is selected from the group consistingof a high definition content protection (HDCP) protocol and a protectedaudio video path protocol.

Example 31

This example includes any or all of the elements of any one of examples18 to 30, wherein the plurality of DRM protocols includes an advancedaudio content system (AACS) protocol, a high definition contentprotection protocol, a digital transmission content protection (DTCP)protocol, a digital transmission content protection mapped to internetprotocol (DTCP-IP), and combinations thereof.

Example 32

This example includes any or all of the elements of example 21, whereinthe client is to receive the digital information from a contentprovider, and the method further includes: identifying the first DRMprotocol at least in part by comparing information in a contenttransmission request from the content provider to the DRM repository;directing transmission of the digital information from the contentprovider to the preexisting SIPE when a preexisting SIPE supporting thefirst DRM protocol is present on the client device; and directingtransmission of the digital information from the content provider to thenew SIPE, when a preexisting SIPE supporting the first DRM protocol isnot present on the client device.

Example 33

This example includes any or all of the elements of example 32, whereinthe content provider is a content server, a recording medium andcombinations thereof.

Example 34

This example includes any or all of the elements of any one of examples18 to 33, wherein the client is to receive the digital information froma sensor, and the method further includes: identifying the first DRMprotocol at least in part by analyzing sensor data attributes receivedfrom the sensor; directing transmission of the digital information fromthe sensor to the preexisting SIPE when a preexisting SIPE supportingthe first DRM protocol is present on the client device; and directingtransmission of the digital information from the sensor to the new SIPE,when a preexisting SIPE supporting the first DRM protocol is not presenton the client device.

Example 35

According to this example there is provided at least one computerreadable storage medium having instructions stored thereon forsupporting a plurality of digital rights management (DRM) protocols witha client device, the client device including an architectural enclave,wherein the instructions when executed cause the client device toperform the following operations including: identify a first DRMprotocol of the plurality of DRM protocols, the first DRM protocol toprotect the digital information received by the client device from atleast one of a content provider and a sensor; select a preexisting SIPEsupporting the first DRM protocol for processing the first digitalinformation, when a preexisting SIPE supporting the first DRM protocolexists on the client device; and create and select a new SIPE supportingthe first DRM protocol on the client device for processing the firstdigital information, when a preexisting SIPE supporting the first DRMprotocol does not exist on the client device.

Example 36

This example includes any or all of the elements of example 35, whereinthe architectural enclave, the preexisting SIPE, and the new SIPE areeach a memory enclave.

Example 37

This example includes any or all of the elements of any one of examples35 and 36, wherein the client includes a plurality of preexisting secureinformation processing environments (SIPEs), wherein each of the SIPEsis configured to support a different one of the plurality of DRMprotocols.

Example 38

This example includes any or all of the elements of any one of examples35 to 37, wherein the client device further includes a digital rightsmanagement (DRM) repository in the architectural enclave, the DRMrepository including a data structure associating at least a DRMidentifier of the first DRM protocol with at least one of requirementsand resources needed to execute the first DRM protocol, and theinstructions when executed further cause the client device to determinewhether a pre-existing SIPE supporting the first DRM protocol is presenton the client device at least in part by: comparing the requirementsassociated with the DRM identifier correlating to the first DRM protocolto the configuration of each preexisting SIPE on the client device; andidentifying a first preexisting SIPE as supporting the first DRMprotocol if the configuration of the first preexisting SIPE meets therequirements associated with the DRM identifier correlating to the firstDRM protocol

Example 39

This example includes any or all of the elements of example 38, whereinthe instructions when executed further cause the client device torequest resources needed to implement the first DRM protocol from thecontent provider, the sensor, a trusted third party, or combinationthereof, when the resources are not present in the preexisting SIPE, newSIPE, or the DRM repository.

Example 40

This example includes any or all of the elements of any one of examples35 to 39, wherein the digital information from the sensor includessensor data.

Example 41

This example includes any or all of the elements of any one of examples35 to 40, wherein the client device includes a plurality of preexistingsecure information processing environments (SIPEs), wherein each of thepreexisting SIPEs is configured to support a different one of theplurality of DRM protocols.

Example 42

This example includes any or all of the elements of any one of examples35 to 41, wherein the instructions when executed further cause theclient device to perform digital rights management operations consistentwith the first DRM protocol within the preexisting SIPE, the new SIPE,or a combination thereof.

Example 43

This example includes any or all of the elements of example 42, whereinthe digital rights management operations comprise at least one of:decrypting the digital information, demodulating the digitalinformation, decoding the digital information, encoding the digitalinformation, encrypting the digital information, and combinationsthereof.

Example 44

This example includes any or all of the elements of example 42, whereinthe DRM operations comprise processing the digital information forsecure video output.

Example 45

This example includes any or all of the elements of example 44, whereinprocessing the digital information for secure video output includesprocessing the digital information to comply with a protected audiovideo protocol.

Example 46

This example includes any or all of the elements of example 45, whereinthe protected audio video protocol is selected from the group consistingof a high definition content protection (HDCP) protocol and a protectedaudio video path protocol.

Example 47

This example includes any or all of the elements of any one of examples35 to 46, wherein the plurality of DRM protocols includes an advancedaudio content system (AACS) protocol, a high definition contentprotection protocol, a digital transmission content protection (DTCP)protocol, a digital transmission content protection mapped to internetprotocol (DTCP-IP), and combinations thereof.

Example 48

This example includes any or all of the elements of example 38, whereinthe client is to receive the digital information from a contentprovider, and the instructions when executed further cause the clientdevice to perform the following operations including: identify the firstDRM protocol at least in part by comparing information in a contenttransmission request from the content provider to the DRM repository;direct transmission of the digital information from the content providerto the preexisting SIPE when a preexisting SIPE supporting the first DRMprotocol is present on the client device; and direct transmission of thedigital information from the content provider to the new SIPE, when apreexisting SIPE supporting the first DRM protocol is not present on theclient device.

Example 49

This example includes any or all of the elements of example 48, whereinthe content provider is a content server, a recording medium andcombinations thereof.

Example 50

This example includes any or all of the elements of any one of examples35 to 49, wherein the client is to receive the digital information froma sensor provider, and the instructions when executed further cause theclient device to perform the following operations including: identifythe first DRM protocol at least in part by analyzing sensor dataattributes received from the sensor; direct transmission of the digitalinformation from the sensor to the preexisting SIPE when a preexistingSIPE supporting the first DRM protocol is present on the client device;and direct transmission of the digital information from the sensor tothe new SIPE, when a preexisting SIPE supporting the first DRM protocolis not present on the client device.

Example 51

According to this example there is provided at least one computerreadable medium including instructions which when executed by a clientdevice cause the client device to perform a method in accordance withany one of examples 18-35.

Example 52

According to this example there is provided a client device includingmeans to perform the method of any one of examples 18-35.

The terms and expressions which have been employed herein are used asterms of description and not of limitation, and there is no intention,in the use of such terms and expressions, of excluding any equivalentsof the features shown and described (or portions thereof), and it isrecognized that various modifications are possible within the scope ofthe claims. Accordingly, the claims are intended to cover all suchequivalents.

What is claimed is:
 1. A client device to support a plurality of digitalrights management (DRM) protocols, comprising a processor, at least onearchitectural enclave, and at least one policy enforcement module (PEM)stored and executed within said architectural enclave, wherein said PEMis to: identify a first DRM protocol from a plurality of DRM protocols,wherein said first DRM protocol is to protect digital informationreceived from at least one of a content provider and a sensor, select apreexisting secure information processing environment (SIPE) supportingsaid first DRM protocol for processing said first digital information,when a preexisting SIPE supporting said first DRM protocol exists onsaid client device; create and select a new SIPE supporting said firstDRM protocol on said client device for processing said first digitalinformation, when a preexisting SIPE supporting said first DRM protocoldoes not exist on said client device; and wherein said architecturalenclave, said preexisting SIPE, and said new SIPE are each a memoryenclave, wherein a memory enclave comprises at least one page of memoryhaving a different access policy than an access policy imposed byconventional ring boundaries in a computing device.
 2. The client deviceof claim 1, wherein said client comprises a plurality of preexistingsecure information processing environments (SIPEs), wherein each of saidSIPEs is configured to support a different one of said plurality of DRMprotocols.
 3. The client device of claim 1, wherein said client devicefurther comprises a digital rights management (DRM) repository in saidarchitectural enclave, said DRM repository comprising a data structureassociating at least a DRM identifier of said first DRM protocol with ofrequirements and resources needed to execute said first DRM protocol,wherein said PEM is further to determine whether said pre-existing SIPEsupporting said first DRM protocol is present on said client device atleast in part by: comparing the requirements associated with said DRMidentifier correlating to said first DRM protocol to the configurationof each preexisting SIPE on said client device; and identifying a firstpreexisting SIPE as supporting said first DRM protocol if theconfiguration of said first preexisting SIPE meets said requirementsassociated with said DRM identifier correlating to said first DRMprotocol.
 4. The client device of claim 2, wherein said PEM is furtherto request resources needed to implement said first DRM protocol, whensaid resources are not present in said preexisting SIPE, new SIPE, orsaid DRM repository.
 5. The client device of claim 1, further comprisinga digital rights management enforcement module (DRMEM) to execute withinat least one of said preexisting SIPE and said new SIPE, the DRMEM toperform digital rights management operations consistent with said firstDRM protocol within said preexisting SIPE, said new SIPE, or acombination thereof.
 6. The client device of claim 5, wherein saiddigital rights management operations comprise at least one of:decrypting said digital information, demodulating said digitalinformation, decoding the digital information, encoding the digitalinformation, encrypting the digital information, and combinationsthereof.
 7. The client device of claim 3, wherein said client is toreceive said digital information from a content provider, and said PEMis further to: identify said first DRM protocol at least in part bycomparing information in a content transmission request from saidcontent provider with said DRM repository; direct transmission of saiddigital information from said content provider to said preexisting SIPEwhen a preexisting SIPE supporting said first DRM protocol is present onsaid client device; and direct transmission of said digital informationfrom said content provider to said new SIPE, when a preexisting SIPEsupporting said first DRM protocol is not present on said client device.8. A method for supporting a plurality of digital rights management(DRM) protocols with a client device, the client device comprising anarchitectural enclave having a policy enforcement module stored andexecuted therein, wherein the method comprises: identifying a first DRMprotocol of said plurality of DRM protocols, said first DRM protocol toprotect said digital information received by said client device from atleast one of a content provider and a sensor; selecting a preexistingsecure information processing environment (SIPE) supporting said firstDRM protocol for processing said first digital information, when apreexisting SIPE supporting said first DRM protocol exists on saidclient device; creating and selecting a new SIPE supporting said firstDRM protocol on said client device for processing said first digitalinformation, when a preexisting SIPE supporting said first DRM protocoldoes not exist on said client device; and wherein said architecturalenclave, said preexisting SIPE, and said new SIPE are each a memoryenclave, wherein a memory enclave comprises at least one page of memoryhaving a different access policy than an access policy imposed byconventional ring boundaries in a computing device.
 9. The method ofclaim 8, wherein said client comprises a plurality of preexisting secureinformation processing environments (SIPEs), wherein each of said SIPEsis configured to support a different one of said plurality of DRMprotocols, and the method comprises determining whether at least one ofthe preexisting SIPEs supports said first DRM protocol.
 10. The methodof claim 8, wherein said client device further comprises a digitalrights management (DRM) repository in said architectural enclave, theDRM repository comprising a data structure associating at least a DRMidentifier of said first DRM protocol with at least one of requirementsand resources needed to execute said first DRM protocol, and the methodfurther comprises determining whether a pre-existing SIPE supportingsaid first DRM protocol is present on said client device at least inpart by: comparing the requirements associated with said DRM identifiercorrelating to said first DRM protocol to the configuration of eachpreexisting SIPE on said client device; and identifying a firstpreexisting SIPE as supporting said first DRM protocol if theconfiguration of said first preexisting SIPE meets said requirementsassociated with said DRM identifier correlating to said first DRMprotocol.
 11. The method of claim 10, further comprising: requestingresources needed to implement said first DRM protocol from said contentprovider, said sensor, a trusted third party, or combination thereof,when said resources are not present in said preexisting SIPE, new SIPE,or said DRM repository.
 12. The method of claim 8, further comprising adigital rights management enforcement module (DRMEM) to execute withinat least one of said preexisting SIPE and said new SIPE, the methodfurther comprising performing digital rights management operationsconsistent with said first DRM protocol at least in part with saidDRMEM, and within said preexisting SIPE, said new SIPE, or a combinationthereof.
 13. The method of claim 12, wherein said digital rightsmanagement operations comprise at least one of: decrypting said digitalinformation, demodulating said digital information, decoding the digitalinformation, encoding the digital information, encrypting the digitalinformation, and combinations thereof.
 14. The method of claim 10,wherein said client is to receive said digital information from acontent provider, and the method further comprises: identifying saidfirst DRM protocol at least in part by comparing information in acontent transmission request from said content provider to said DRMrepository; directing transmission of said digital information from saidcontent provider to said preexisting SIPE when a preexisting SIPEsupporting said first DRM protocol is present on said client device; anddirecting transmission of said digital information from said contentprovider to said new SIPE, when a preexisting SIPE supporting said firstDRM protocol is not present on said client device.
 15. At least onenon-transitory computer readable storage medium having instructionsstored thereon for supporting a plurality of digital rights management(DRM) protocols with a client device, the client device comprising anarchitectural enclave, wherein said instructions when executed cause theclient device to perform the following operations comprising: identify afirst DRM protocol of said plurality of DRM protocols, said first DRMprotocol to protect said digital information received by said clientdevice from at least one of a content provider and a sensor; select apreexisting SIPE supporting said first DRM protocol for processing saidfirst digital information, when a preexisting SIPE supporting said firstDRM protocol exists on said client device; create and select a new SIPEsupporting said first DRM protocol on said client device for processingsaid first digital information, when a preexisting SIPE supporting saidfirst DRM protocol does not exist on said client device; and whereinsaid architectural enclave, said preexisting SIPE, and said new SIPE areeach a memory enclave, wherein a memory enclave comprises at least onepage of memory having a different access policy than an access policyimposed by conventional ring boundaries in a computing device.
 16. Theat least one computer readable storage medium of claim 15, wherein saidclient comprises a plurality of preexisting secure informationprocessing environments (SIPEs), wherein each of said SIPEs isconfigured to support a different one of said plurality of DRMprotocols.
 17. The at least one computer readable storage medium ofclaim 15, wherein said client device further comprises a digital rightsmanagement (DRM) repository in said architectural enclave, the DRMrepository comprising a data structure associating at least a DRMidentifier of said first DRM protocol with at least one of requirementsand resources needed to execute said first DRM protocol, and saidinstructions when executed further cause said client device to determinewhether a pre-existing SIPE supporting said first DRM protocol ispresent on said client device at least in part by: comparing therequirements associated with said DRM identifier correlating to saidfirst DRM protocol to the configuration of each preexisting SIPE on saidclient device; and identifying a first preexisting SIPE as supportingsaid first DRM protocol if the configuration of said first preexistingSIPE meets said requirements associated with said DRM identifiercorrelating to said first DRM protocol.
 18. The at least one computerreadable storage medium of claim 17, wherein said instructions whenexecuted further cause said client device to request resources needed toimplement said first DRM protocol from said content provider, saidsensor, a trusted third party, or combination thereof, when saidresources are not present in said preexisting SIPE, new SIPE, or saidDRM repository.
 19. The at least one computer readable storage medium ofclaim 15, wherein said instructions when executed further cause saidclient device to perform digital rights management operations consistentwith said first DRM protocol within said preexisting SIPE, said newSIPE, or a combination thereof.
 20. The at least one computer readablestorage medium of claim 19, wherein said digital rights managementoperations comprise at least one of: decrypting said digitalinformation, demodulating said digital information, decoding the digitalinformation, encoding the digital information, encrypting the digitalinformation, and combinations thereof.
 21. The at least one computerreadable storage medium of claim 17, wherein said client is to receivesaid digital information from a content provider, and said instructionswhen executed further cause said client device to perform the followingoperations comprising: identify said first DRM protocol at least in partby comparing information in a content transmission request from saidcontent provider to said DRM repository; direct transmission of saiddigital information from said content provider to said preexisting SIPEwhen a preexisting SIPE supporting said first DRM protocol is present onsaid client device; and direct transmission of said digital informationfrom said content provider to said new SIPE, when a preexisting SIPEsupporting said first DRM protocol is not present on said client device.22. The at least one computer readable storage medium of claim 21,wherein said content provider is a content server, a recording mediumand combinations thereof.